Last updated: July 13, 20261. Introduction
This Privacy Policy explains how Loom24, operated by OÜ Pecunium Invest (registry code 14971397), collects, uses, stores, and protects your personal data when you use our platform. We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.Loom24 is the successor to our earlier platform. If you had an account on the previous loom24.ee site, your account, listings, and lost pet reports were carried over to this platform. The data controller has remained the same throughout, OÜ Pecunium Invest, and the migration did not change the purposes for which your data is processed.2. Data Controller
The data controller responsible for your personal data is OÜ Pecunium Invest, registry code 14971397 (Estonian Business Register), address Roheline tn 16, Tähtvere küla, Tartu linn, Tartu maakond 61410, Estonia.Email: info@loom24.ee3. Personal Data We Collect
Account data: when you create an account, we collect your name, email address, and password (stored in hashed form). You may optionally provide a phone number and profile picture. If you sign in with a Google account, we receive your email address, name, and Google account identifier from Google, and no password is stored.Listing content: when you create listings, we collect the information you provide, including descriptions, photos, prices, and location data.Platform activity data: messages you send to a listing owner, including any phone number you provide in the message; saved searches and their filters; listings you mark as favourites; reports you submit about content; and feedback you send us.Consent and security records: the time and version of your acceptance of the Terms and this Privacy Policy, together with the IP address and browser identifier used, as well as login attempts, sessions, and other records needed to keep sign-in secure.Technical data: we automatically collect certain technical information when you visit our platform, including your IP address, browser type, operating system, and pages visited. This data is used for security, performance monitoring, and platform improvement.Publicly visible data: some of your data is public on the Platform, meaning it is visible to every visitor, including people without an account. Your listings and lost pet reports display your first name, profile picture, and public user identifier. Lost pet reports additionally display your contact phone number, so that someone who spots the animal can call you directly. Your last name and email address are never displayed publicly. Published data is also visible to search engines and may be collected by third parties, so only share what you are willing to make public.4. Purpose and Legal Basis
Contract performance (GDPR § 6(1)(b)): we process your data to provide our marketplace services, manage your account, facilitate transactions between buyers and sellers, and communicate with you about your listings.Legal obligation (GDPR § 6(1)(c)): we process certain data to comply with legal requirements, including tax record keeping, consumer protection obligations, and responding to lawful requests from authorities.Consent (GDPR § 6(1)(a)): where we use analytics or optional features that are not strictly necessary for providing our services, we will obtain your explicit consent before processing your data for these purposes. You may withdraw your consent at any time.Legitimate interest (GDPR Art 6(1)(f)): we process data to protect our users and the Platform — preventing fraud and abuse, moderating listings and reports, diagnosing and fixing failures, and maintaining the security of the service — and to establish, exercise, or defend legal claims. We have weighed these interests against your rights, and you may object to this processing at any time.5. Data Recipients
Resend: transactional emails (password resets, account notifications). Email addresses are shared with Resend solely for delivery purposes.Google Cloud Platform (GCP): our platform infrastructure and database are hosted on GCP in the European Union (region europe-north1, Finland). GCP acts as a processor on our instructions.Sentry: application error monitoring and limited session replay for debugging and platform stability. Session replay runs only if you consent to analytics cookies. We use data scrubbing settings and never knowingly send Sentry payment card details or account passwords. Sentry error events are stored in the European Union (Germany).Google Cloud Translation: if you choose to translate a listing or lost pet description, that description is sent to Google Cloud Translation and routed through Google’s European Union regional endpoint to produce a translation in the language you selected. Translation happens only at your request, never automatically.Google Analytics (GA4): if you opt in to analytics cookies, usage data (pages visited, interactions on the platform, approximate location derived from your IP address, and device and browser information) is shared with Google to help us understand how the platform is used. Analytics is off by default and runs only after your consent, which you can withdraw at any time in the cookie settings. See our Cookie Policy for the specific cookies involved.6. Transfers Outside the European Economic Area
Some of our processors are companies established in the United States, which means your personal data may reach recipients outside the European Economic Area.Resend (transactional email) is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision. Sentry and Google are also companies established in the United States: Sentry stores error events in the European Union (Germany) and translation requests are routed to Google’s European Union regional endpoint, but access from outside the European Economic Area cannot be entirely ruled out because of where the parent companies are established.Where a transfer takes place, we rely either on a European Commission adequacy decision (the EU-US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses together with supplementary safeguards. To request a copy of these documents, contact us at info@loom24.ee.7. Data Retention
We retain your personal data for as long as your account is active and as needed to provide you with our services. To request deletion of your account and personal data, contact us at info@loom24.ee. We will process your request within 30 days in accordance with GDPR, except where we are required to retain certain data by law.Tax-related data is retained for 7 years in accordance with Estonian accounting and tax legislation.We keep other data for as long as the purpose for which it was collected requires: application error and performance logs for the retention period configured at our monitoring provider; login attempts and security records for as long as they are needed to detect and prevent abuse; and moderation, notice, and audit records for as long as they are needed for accountability or to establish, exercise, or defend legal claims.8. Your Rights
Under the GDPR, you have the following rights regarding your personal data: the right of access (to obtain a copy of your data), the right to rectification (to correct inaccurate data), the right to erasure (to request deletion of your data), the right to data portability (to receive your data in a structured format), the right to restriction of processing, and the right to object to processing.To exercise any of these rights, please contact us at info@loom24.ee. We will respond to your request within 30 days. You may be asked to verify your identity before we process your request.To request a copy of your personal data, contact us at info@loom24.ee. We will provide an export of your account data — including your profile, listings, lost pet reports, and uploaded images — as a downloadable file in a structured, commonly used, and machine-readable format. To request deletion of your account, contact the same address; we will complete the deletion within 30 days, except where law requires us to retain certain data.9. Automated Decisions and Profiling
We do not make automated decisions about you that produce legal effects or similarly significantly affect you, and we do not profile you within the meaning of the GDPR. Decisions to moderate or restrict content and to suspend accounts are always made by a person. Similar-listing suggestions are based only on the listing’s category and breed, never on your behaviour or on a profile of you.10. Right to Complain
If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).Website: https://www.aki.ee11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Platform. The "Last updated" date at the top of this page indicates when this policy was last revised. This Privacy Policy is provided for your information: it is not a contract, and it does not replace consent, which you can always give or withdraw separately.12. Contact
For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us.Email: info@loom24.ee